(navigation image)
Home Animation & Cartoons | Arts & Music | Community Video | Computers & Technology | Cultural & Academic Films | Ephemeral Films | Movies | News & Public Affairs | Prelinger Archives | Spirituality & Religion | Sports Videos | Television | Videogame Videos | Vlogs | Youth Media
Search: Advanced Search
Anonymous User (login or join us)
Upload

View movie

item imageitem imageitem imageitem image

View thumbnails

Play / Download (help[help])

(156.2 M)Ogg Video
(219.9 M)h.264
(615.4 M)QuickTime


All Files: HTTPS Torrent (2/0)
[Attribution-Share Alike 3.0]

Resources

Bookmark

Corey K.Day 1 Part 4: Exploits 2: Exploitation in the Windows Environment

something has gone horribly wrong 8-p
Prefer flash? · Embed · Questions/Feedback?

The class materials are available at http://www.OpenSecurityTraining.info/Exploits2.html
Follow us on Twitter for class news @OpenSecTraining.

This course covers the exploitation of stack corruption vulnerabilities in the Windows environment. Stack overflows are programming flaws that often times allow an attacker to execute arbitrary code in the context of a vulnerable program. There are many nuances involved with exploiting these vulnerabilities in Windows. Window's exploit mitigations such as DEP, ASLR, SafeSEH, and SEHOP, makes leveraging these programming bugs more difficult, but not impossible. The course highlights the features and weaknesses of many the exploit mitigation techniques deployed in Windows operating systems. Also covered are labs that describe the process of finding bugs in Windows applications with mutation based fuzzing, and then developing exploits that target those bugs.

Topics covered in the labs for this class include:
* Exploiting a vanilla Windows stack overflow with no mitigations turned on
* Using WinDbg to analyze our crashes
* Removing bytes from your payload (such as nulls) which would prevent exploitation
* Finding functions to call by walking the Thread Execution Block to find kernel32.dll's location in memory so we can call functions like LoadLibrary() and GetProcAddress()
* Hashing strings to use for comparison when searching for functions, in order to minimize the size of the payload
* Overwriting Structured Exception Handlers (SEH) as a means to bypass stack cookies (/GS compile option) and bypassing the SafeSEH mitigation
* Overwriting virtual function table function pointers in C++ code as another way around stack cookies
* Using Return Oriented Programming (ROP) to defeat Data Execution Prevention (DEP) aka non-executable (NX) stack
* Using libraries which opt out of Address Space Layout Randomization (ASLR) and SafeSEH to bypass these mitigations
* Using Python to mutationally fuzz the custom, never-before-analyzed, Corey's Crappy Document Format and Crappy Document Reader in order to find and exploit the numerous bugs within


This movie is part of the collection: OpenSecurityTraining.info

Producer: Corey K.
Audio/Visual: sound, color
Keywords: OpenSecurityTraining.info; Exploits; Vulnerabilities; software vulnerabilities; buffer overflows; smashing the stack; SEH; structured exception handling; SEHOP; SafeSEH; DEP; Data Execution Prevention; bypassing DEP; ASLR; Address Space Layout Randomization; bypassing ASLR; fuzzing; fuzzer; reverse engineering; Computers; Computer Security; Technology; Intel; x86; IA32; Training; Education; Multi-day-class; Multi-day-training; Classes

Creative Commons license: Attribution-Share Alike 3.0


Individual Files

Movie Files QuickTime h.264 Ogg Video
PR_Exploits2-D1P4.mov 615.4 MB 
219.9 MB 
156.2 MB 
Image Files Thumbnail Animated GIF
PR_Exploits2-D1P4.mov 5.3 KB 
384.8 KB 
Information FormatSize
Day1Part4Exploits2IntroductionToSoftwareExploitationInTheWindows_files.xml Metadata [file] 
Day1Part4Exploits2IntroductionToSoftwareExploitationInTheWindows_meta.xml Metadata 3.2 KB 
Other Files Archive BitTorrent
Day1Part4Exploits2IntroductionToSoftwareExploitationInTheWindows_archive.torrent 41.0 KB 

Be the first to write a review
Downloaded 997 times
Reviews